PT-2026-55676 · Picklescan · Picklescan

Fredericdt · Publicado 2026-07-04 · Atualizado 2026-07-04 · CVE-2025-71366

NVD

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck. main .run cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbitrary code execution when victims load the files.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2025-71366

Produtos afetados

Picklescan

Referências · 3

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4r9r-ch6f-vxmx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-71366 · Nota de Segurança
• https://vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-bottleneck-main-run-cprofile · Nota